Processing Details and Legal Bases:

When the transaction based lending payment option offered by MIR Lux Capital S.à r.l., (“MIR Lux”) is used, the Marketplace will share certain personal data with MIR Lux, including names, email, physical address, phone number as well as other relevant contact details of representatives and other employees of the Seller and the Buyer. When buyers opt for the transaction based lending payment option, the underlying payment claims will be assigned to MIR Lux. MIR Lux processes such personal data in connection with providing the transaction based lending payment option as an independent controller, including for the purpose of (i) collecting and enforcing payment claims based on its connected legitimate interests pursuant to Art. 6(1)(f) GDPR, and (ii) carrying out KYC checks based on its statutory obligations to carry out identity checks pursuant to Art. 6(1)(c) GDPR as well as based on its legitimate interests pursuant to Art. 6(1)(f) GDPR. MIR Lux has further engaged Finmid GmbH (“Finmid”) with the collection of payment claims. For such purpose, the data categories as specified above will also be shared with Finmid. Finmid will process such data in order to provide its collection services to MIR Lux based on its legitimate interests pursuant to Art. 6(1)(f) GDPR based on its interest to fulfill its contractual obligations towards MIR Lux as an independent controller.

Name and Contact Details of MIR Lux and Finmid:

• MIR Lux Capital S.à r.l., 16, rue Eugène Ruppert, L-2453, Luxembourg, Grand-Duché de Luxembourg, to the attention of the Managing Directors Federico Papandrea and Agnieszka Szczepankiewicz
• Finmid GmbH, c/o WeWork, Stresemannstraße 123, 10963 Berlin, legalnotice@finmid.com

Duration of Processing:

MIR Lux and Finmid process and store the personal data only as long as they are needed in connection with a lawful purpose. Both then erase the personal data immediately, unless they still need these data until expiry of the statutory period of limitation for purposes of evidence in civil claims or due to statutory duties of storage in accordance to Art. 6 (1) (c) and (f) DSGVO.

Transmission of Personal Data to Data Recipients:

MIR Lux and Finmid will engage service providers in the data processing. These include in particular Finmid as a KYC service provider on behalf of MIR Lux, IT service providers which maintain MIR Lux’s and Finmid’s systems, and consultancy firms. To the extent, MIR Lux or Finmid pass personal data on to service providers, the personal data may only be used for performance of their tasks.

Transmission of personal data to third countries:

Some service provider are partly located in so-called third countries (outside the European Union or the European Economic Area) or process personal data there, i.e. countries whose level of data protection does not correspond to that of the European Union. MIR Lux and Finmid may transfer the personal data to such third countries. Where this is the case and the European Commission has not issued an adequacy decision (Art. 45 GDPR) for these countries, MIR Lux and Finmid have taken appropriate precautions to ensure an adequate level of data protection for any data transfers. These include, among others, the standard contractual clauses of the European Union or binding internal data protection regulations. Where this is not possible, MIR Lux and Finmid base the transfer of personal data on exceptions to Art. 49 GDPR in particular the data subject’s expressed consent or the necessity of the transfer for the performance of the contract or for the implementation of pre-contractual measures.

If a third country transfer is provided for and there is no adequacy decision or suitable guarantees, it is possible and there is a risk that authorities in the respective third country (e.g. intelligence services) may gain access to the transferred data in order to collect and analyze it, and that enforceability of the personal data subject rights cannot be guaranteed.

Data Subjects Rights:

Each data subject is entitled to withdraw its consent (Art. 6 (1) (a) GDPR), to object to the processing of its personal data (Art. 21 GDPR), to information about its personal data processed (Art. 15 GDPR), to rectify its personal data stored that is incorrect (Art. 16 GDPR), to erasure of its personal data (Art. 17 GDPR), to restrict the processing of its personal data (Art. 18 GDPR), to data portability of its personal data (Art. 20 GDPR) and to lodge a complaint with a supervisory authority (Art. 77 GDPR).

Each data subject also has the right to object to the processing of its personal data where MIR Lux or Finmid are relying on a legitimate interests (Art. 6 (1) (f) GDPR) and there is something about the particular situation which makes the respective data subject want to object to processing on this ground as the data subject feels it impacts its fundamental rights and freedoms. If applicable, the data subject also has the right to object where MIR Lux and Finmid are processing its personal data for direct marketing purposes. In some cases, MIR Lux and Finmid may demonstrate that they have compelling legitimate reasons to process the respective information which overrides the data subject’s rights and freedoms. To exercise the data subject rights described here, the data subject can contact MIR Lux and Finmid at any time using the contact details above.